Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 17:28
Behavioral task
behavioral1
Sample
8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe
Resource
win10v2004-20241007-en
General
-
Target
8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe
-
Size
2.9MB
-
MD5
040b375855ea5ace05bcf21700b4a4d0
-
SHA1
37fddea16f6f496dff7bf28fdd74864846bb1db6
-
SHA256
8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbd
-
SHA512
e00191bad024e2bc2d971b85ba7a775ef31d7c5aa36a26fd9313ce64a2a8765eb9785a2c4b44e1e4ed75690116ca3a90b68307c61c1d1d9f83eb0d997727fbda
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHc:7v97AXmw4gxeOw46fUbNecCCFbNecN
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral2/files/0x0009000000023cb8-34.dat warzonerat behavioral2/files/0x0008000000023cb6-60.dat warzonerat behavioral2/files/0x00030000000226ed-74.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 24 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 46 IoCs
pid Process 3224 explorer.exe 2680 explorer.exe 4132 explorer.exe 1684 spoolsv.exe 3312 spoolsv.exe 1424 spoolsv.exe 5020 spoolsv.exe 3592 spoolsv.exe 3980 spoolsv.exe 4696 spoolsv.exe 1808 spoolsv.exe 4568 spoolsv.exe 216 spoolsv.exe 4892 spoolsv.exe 3128 spoolsv.exe 1248 spoolsv.exe 924 spoolsv.exe 828 spoolsv.exe 4228 spoolsv.exe 3164 spoolsv.exe 4024 spoolsv.exe 2648 spoolsv.exe 3440 spoolsv.exe 4592 spoolsv.exe 2612 spoolsv.exe 3236 spoolsv.exe 1576 spoolsv.exe 4940 spoolsv.exe 4868 spoolsv.exe 1464 spoolsv.exe 2436 spoolsv.exe 3056 spoolsv.exe 4976 spoolsv.exe 4580 spoolsv.exe 2840 spoolsv.exe 4864 spoolsv.exe 2124 spoolsv.exe 4672 spoolsv.exe 5000 spoolsv.exe 3316 spoolsv.exe 1352 spoolsv.exe 4072 spoolsv.exe 5092 spoolsv.exe 828 spoolsv.exe 3224 spoolsv.exe 3500 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe -
Suspicious use of SetThreadContext 26 IoCs
description pid Process procid_target PID 5020 set thread context of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 1076 set thread context of 936 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 94 PID 1076 set thread context of 3604 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 95 PID 3224 set thread context of 2680 3224 explorer.exe 99 PID 2680 set thread context of 4132 2680 explorer.exe 100 PID 1684 set thread context of 3312 1684 spoolsv.exe 105 PID 1424 set thread context of 5020 1424 spoolsv.exe 109 PID 3592 set thread context of 3980 3592 spoolsv.exe 113 PID 4696 set thread context of 1808 4696 spoolsv.exe 117 PID 4568 set thread context of 216 4568 spoolsv.exe 121 PID 4892 set thread context of 3128 4892 spoolsv.exe 125 PID 1248 set thread context of 924 1248 spoolsv.exe 129 PID 828 set thread context of 4228 828 spoolsv.exe 133 PID 3164 set thread context of 4024 3164 spoolsv.exe 137 PID 2648 set thread context of 3440 2648 spoolsv.exe 141 PID 4592 set thread context of 2612 4592 spoolsv.exe 145 PID 3236 set thread context of 1576 3236 spoolsv.exe 149 PID 4940 set thread context of 4868 4940 spoolsv.exe 153 PID 1464 set thread context of 2436 1464 spoolsv.exe 157 PID 3056 set thread context of 4976 3056 spoolsv.exe 161 PID 4580 set thread context of 2840 4580 spoolsv.exe 165 PID 4864 set thread context of 2124 4864 spoolsv.exe 169 PID 4672 set thread context of 5000 4672 spoolsv.exe 173 PID 3316 set thread context of 1352 3316 spoolsv.exe 177 PID 4072 set thread context of 5092 4072 spoolsv.exe 181 PID 828 set thread context of 3224 828 spoolsv.exe 185 -
Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 936 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 936 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 3224 explorer.exe 3224 explorer.exe 1684 spoolsv.exe 1684 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 4132 explorer.exe 4132 explorer.exe 1424 spoolsv.exe 1424 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 3592 spoolsv.exe 3592 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 4696 spoolsv.exe 4696 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 4568 spoolsv.exe 4568 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 4892 spoolsv.exe 4892 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 1248 spoolsv.exe 1248 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 828 spoolsv.exe 828 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 3164 spoolsv.exe 3164 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 2648 spoolsv.exe 2648 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 4592 spoolsv.exe 4592 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 3236 spoolsv.exe 3236 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 4940 spoolsv.exe 4940 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 1464 spoolsv.exe 1464 spoolsv.exe 4132 explorer.exe 4132 explorer.exe -
Suspicious use of SetWindowsHookEx 54 IoCs
pid Process 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 936 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 936 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 3224 explorer.exe 3224 explorer.exe 4132 explorer.exe 4132 explorer.exe 1684 spoolsv.exe 1684 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 1424 spoolsv.exe 1424 spoolsv.exe 3592 spoolsv.exe 3592 spoolsv.exe 4696 spoolsv.exe 4696 spoolsv.exe 4568 spoolsv.exe 4568 spoolsv.exe 4892 spoolsv.exe 4892 spoolsv.exe 1248 spoolsv.exe 1248 spoolsv.exe 828 spoolsv.exe 828 spoolsv.exe 3164 spoolsv.exe 3164 spoolsv.exe 2648 spoolsv.exe 2648 spoolsv.exe 4592 spoolsv.exe 4592 spoolsv.exe 3236 spoolsv.exe 3236 spoolsv.exe 4940 spoolsv.exe 4940 spoolsv.exe 1464 spoolsv.exe 1464 spoolsv.exe 3056 spoolsv.exe 3056 spoolsv.exe 4580 spoolsv.exe 4580 spoolsv.exe 4864 spoolsv.exe 4864 spoolsv.exe 4672 spoolsv.exe 4672 spoolsv.exe 3316 spoolsv.exe 3316 spoolsv.exe 4072 spoolsv.exe 4072 spoolsv.exe 828 spoolsv.exe 828 spoolsv.exe 3500 spoolsv.exe 3500 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 1072 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 82 PID 5020 wrote to memory of 1072 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 82 PID 5020 wrote to memory of 1072 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 82 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 5020 wrote to memory of 1076 5020 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 84 PID 1076 wrote to memory of 936 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 94 PID 1076 wrote to memory of 936 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 94 PID 1076 wrote to memory of 936 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 94 PID 1076 wrote to memory of 936 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 94 PID 1076 wrote to memory of 936 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 94 PID 1076 wrote to memory of 936 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 94 PID 1076 wrote to memory of 936 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 94 PID 1076 wrote to memory of 936 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 94 PID 1076 wrote to memory of 3604 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 95 PID 1076 wrote to memory of 3604 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 95 PID 1076 wrote to memory of 3604 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 95 PID 1076 wrote to memory of 3604 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 95 PID 1076 wrote to memory of 3604 1076 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 95 PID 936 wrote to memory of 3224 936 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 96 PID 936 wrote to memory of 3224 936 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 96 PID 936 wrote to memory of 3224 936 8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe 96 PID 3224 wrote to memory of 3924 3224 explorer.exe 97 PID 3224 wrote to memory of 3924 3224 explorer.exe 97 PID 3224 wrote to memory of 3924 3224 explorer.exe 97 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99 PID 3224 wrote to memory of 2680 3224 explorer.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe"C:\Users\Admin\AppData\Local\Temp\8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1072
-
-
C:\Users\Admin\AppData\Local\Temp\8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exeC:\Users\Admin\AppData\Local\Temp\8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exeC:\Users\Admin\AppData\Local\Temp\8dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbdN.exe3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3924
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4132 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4428
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3312
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2736
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3980
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1808
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1820
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:216
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3128
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3900
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:924
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4228
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4024
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:952
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3440
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4676
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3784
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4868
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2436
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1104
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1828
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5000
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4272
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2144
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3224
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2764
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:4936
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:3604
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5040b375855ea5ace05bcf21700b4a4d0
SHA137fddea16f6f496dff7bf28fdd74864846bb1db6
SHA2568dacf8a0cb1ff462e9b6836a6c21460856500bbdb177a12c078adf40c1d4bbbd
SHA512e00191bad024e2bc2d971b85ba7a775ef31d7c5aa36a26fd9313ce64a2a8765eb9785a2c4b44e1e4ed75690116ca3a90b68307c61c1d1d9f83eb0d997727fbda
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD5071388c1322389db7913c94839d79bc9
SHA181297006a48aadf87247d4aa63c790b92124b235
SHA256575be5613001e4d930b804d2cbfe051d2f3a89cd75ecf1d3291030d8536ac0f6
SHA5127ea46defc53ff53343a1fe01e4701812448b9750696714983677da3e09d15776d78f53dd557a429bf63e85f6934b18dfb9dbabff704f4600892d502ae2c98407
-
Filesize
2.9MB
MD502ab5c073e1fd774255c9c187713016d
SHA164178d502143bef14deb3a6a6cfdfda15bb8f344
SHA256f76ce274b65bc93b0ef71b1f9fca093d1ed7a64705a6c53eda5ed7341cc968c1
SHA512dc13f0867b689b74d2d25afb82b77bd96437473833fdb44866890db3b890e582c141027fa3b8ef3e34ba1de39b9f6611e7a2494906dff00bd4a788295f3a700e